Docker
Overview
Docker packages applications into isolated containers that run consistently across environments. A Dockerfile defines the image build steps, Compose orchestrates multi-container services, and production patterns ensure small, secure, performant images.
When to use: Containerizing applications, creating reproducible dev environments, orchestrating multi-service stacks, deploying to container platforms (ECS, Kubernetes, Fly.io, Railway, Coolify).
When NOT to use: Simple static sites with no backend (use CDN deploy), single-binary CLI tools (distribute the binary), or when the target platform has native buildpacks (Heroku, Vercel) and you don't need container control.
Quick Reference
| Pattern |
Approach |
Key Points |
| Multi-stage build |
Separate builder and production stages |
80%+ image size reduction, no dev deps in production |
| Layer caching |
Copy lockfile first, install, then copy source |
Dependency layer cached across builds |
| Non-root user |
RUN adduser + USER in final stage |
Never run production containers as root |
| Health check |
HEALTHCHECK CMD curl or node/python check |
Enables orchestrator restart on failure |
.dockerignore |
Exclude node_modules, .git, .env |
Smaller build context, faster builds |
| Compose services |
compose.yaml with service definitions |
Dev environment in one command |
| Compose override |
compose.prod.yaml with production settings |
Environment-specific config without duplication |
| Named volumes |
volumes: in Compose for persistent data |
Survives container recreation |
| Build cache mount |
RUN --mount=type=cache,target=/root/.npm |
Persistent cache across builds |
| Secrets in build |
RUN --mount=type=secret,id=token |
Never bake secrets into image layers |
| Image pinning |
Pin to major.minor or digest |
Reproducible builds, avoid surprise breakage |
| Container networking |
Custom bridge networks with service discovery |
Containers resolve each other by service name |
| Compose watch |
develop.watch with sync/rebuild actions |
Live reload without volume mounts |
| Init process |
--init flag or tini entrypoint |
Proper signal handling and zombie reaping |
| Multi-platform |
docker buildx build --platform |
ARM (Apple Silicon, Graviton) + x86 in one image |
| Monorepo prune |
turbo prune app --docker |
Minimal build context from workspace dependencies |
| CI layer caching |
cache-from/cache-to with GHA or registry |
Avoid full rebuilds in CI pipelines |
| Debug containers |
docker exec, docker logs, dive |
Inspect running containers and image layers |
Common Mistakes
| Mistake |
Correct Pattern |
| Installing dev dependencies in production image |
Multi-stage build: install in builder, copy artifacts to runtime |
| Copying source before installing dependencies |
Copy lockfile first, npm ci, then copy source for cache reuse |
| Running as root in production |
Create non-root user, USER directive in final stage |
| Hardcoding secrets in Dockerfile or ENV |
Use build secrets (--mount=type=secret) or runtime env |
Using latest tag for base images |
Pin to specific version (node:24-alpine) |
No .dockerignore file |
Exclude node_modules, .git, .env, build artifacts |
Using npm install instead of npm ci |
npm ci for deterministic, lockfile-based installs |
| HEALTHCHECK missing |
Add health check for orchestrator integration |
Large base images (node:24) |
Use alpine variants (node:24-alpine) for smaller images |
Ignoring .env file precedence in Compose |
environment: in Compose overrides .env file values |
| Building entire monorepo for one service |
Use turbo prune --docker for minimal build context |
| No layer caching in CI |
Use cache-from/cache-to with GHA or registry backend |
| Building only for x86 when deploying to ARM |
Use docker buildx with --platform linux/amd64,linux/arm64 |
Delegation
- Dockerfile review: Use
Task agent to audit Dockerfiles for size, security, and caching
- Compose exploration: Use
Explore agent to discover existing Docker configurations
- Architecture decisions: Use
Plan agent for container orchestration strategy
If the ci-cd-architecture skill is available, delegate CI/CD pipeline and deployment strategy to it.
If the application-security skill is available, delegate container security scanning and hardening review to it.
References
- Dockerfile patterns: multi-stage builds, layer caching, and image optimization
- Compose: services, networking, volumes, and environment management
- Security: non-root users, secrets, scanning, and production hardening
- Buildx: multi-platform builds for ARM and x86
- CI: GitHub Actions caching, registry push, and automated builds
- Monorepo: Turborepo prune, pnpm workspaces, and selective builds
- Debugging: logs, exec, inspect, layer analysis, and network troubleshooting
1---2name: docker3description: Docker containerization for development and production. Covers Dockerfiles, multi-stage builds, layer caching, Compose services, networking, volumes, health checks, security hardening, and production deployment patterns. Use when writing Dockerfiles, optimizing image size, configuring Compose services, debugging container networking, setting up health checks, hardening containers for production, or troubleshooting build cache issues.4license: MIT5---6
7# Docker
8
9## Overview
10
11Docker packages applications into isolated containers that run consistently across environments. A Dockerfile defines the image build steps, Compose orchestrates multi-container services, and production patterns ensure small, secure, performant images.
12
13**When to use:** Containerizing applications, creating reproducible dev environments, orchestrating multi-service stacks, deploying to container platforms (ECS, Kubernetes, Fly.io, Railway, Coolify).
14
15**When NOT to use:** Simple static sites with no backend (use CDN deploy), single-binary CLI tools (distribute the binary), or when the target platform has native buildpacks (Heroku, Vercel) and you don't need container control.
16
17## Quick Reference
18
19| Pattern | Approach | Key Points |
20| -------------------- | ---------------------------------------------- | ---------------------------------------------------- |
21| Multi-stage build | Separate `builder` and `production` stages | 80%+ image size reduction, no dev deps in production |
22| Layer caching | Copy lockfile first, install, then copy source | Dependency layer cached across builds |
23| Non-root user | `RUN adduser` + `USER` in final stage | Never run production containers as root |
24| Health check | `HEALTHCHECK CMD curl` or node/python check | Enables orchestrator restart on failure |
25| `.dockerignore` | Exclude `node_modules`, `.git`, `.env` | Smaller build context, faster builds |
26| Compose services | `compose.yaml` with service definitions | Dev environment in one command |
27| Compose override | `compose.prod.yaml` with production settings | Environment-specific config without duplication |
28| Named volumes | `volumes:` in Compose for persistent data | Survives container recreation |
29| Build cache mount | `RUN --mount=type=cache,target=/root/.npm` | Persistent cache across builds |
30| Secrets in build | `RUN --mount=type=secret,id=token` | Never bake secrets into image layers |
31| Image pinning | Pin to major.minor or digest | Reproducible builds, avoid surprise breakage |
32| Container networking | Custom bridge networks with service discovery | Containers resolve each other by service name |
33| Compose watch | `develop.watch` with sync/rebuild actions | Live reload without volume mounts |
34| Init process | `--init` flag or `tini` entrypoint | Proper signal handling and zombie reaping |
35| Multi-platform | `docker buildx build --platform` | ARM (Apple Silicon, Graviton) + x86 in one image |
36| Monorepo prune | `turbo prune app --docker` | Minimal build context from workspace dependencies |
37| CI layer caching | `cache-from`/`cache-to` with GHA or registry | Avoid full rebuilds in CI pipelines |
38| Debug containers | `docker exec`, `docker logs`, `dive` | Inspect running containers and image layers |
39
40## Common Mistakes
41
42| Mistake | Correct Pattern |
43| ----------------------------------------------- | ---------------------------------------------------------------- |
44| Installing dev dependencies in production image | Multi-stage build: install in builder, copy artifacts to runtime |
45| Copying source before installing dependencies | Copy lockfile first, `npm ci`, then copy source for cache reuse |
46| Running as root in production | Create non-root user, `USER` directive in final stage |
47| Hardcoding secrets in Dockerfile or ENV | Use build secrets (`--mount=type=secret`) or runtime env |
48| Using `latest` tag for base images | Pin to specific version (`node:24-alpine`) |
49| No `.dockerignore` file | Exclude `node_modules`, `.git`, `.env`, build artifacts |
50| Using `npm install` instead of `npm ci` | `npm ci` for deterministic, lockfile-based installs |
51| HEALTHCHECK missing | Add health check for orchestrator integration |
52| Large base images (`node:24`) | Use alpine variants (`node:24-alpine`) for smaller images |
53| Ignoring `.env` file precedence in Compose | `environment:` in Compose overrides `.env` file values |
54| Building entire monorepo for one service | Use `turbo prune --docker` for minimal build context |
55| No layer caching in CI | Use `cache-from`/`cache-to` with GHA or registry backend |
56| Building only for x86 when deploying to ARM | Use `docker buildx` with `--platform linux/amd64,linux/arm64` |
57
58## Delegation
59
60- **Dockerfile review**: Use `Task` agent to audit Dockerfiles for size, security, and caching
61- **Compose exploration**: Use `Explore` agent to discover existing Docker configurations
62- **Architecture decisions**: Use `Plan` agent for container orchestration strategy
63
64> If the `ci-cd-architecture` skill is available, delegate CI/CD pipeline and deployment strategy to it.
65> If the `application-security` skill is available, delegate container security scanning and hardening review to it.
66
67## References
68
69- [Dockerfile patterns: multi-stage builds, layer caching, and image optimization](references/dockerfile-patterns.md)
70- [Compose: services, networking, volumes, and environment management](references/compose.md)
71- [Security: non-root users, secrets, scanning, and production hardening](references/security.md)
72- [Buildx: multi-platform builds for ARM and x86](references/buildx-and-multiplatform.md)
73- [CI: GitHub Actions caching, registry push, and automated builds](references/ci-caching.md)
74- [Monorepo: Turborepo prune, pnpm workspaces, and selective builds](references/monorepo-builds.md)
75- [Debugging: logs, exec, inspect, layer analysis, and network troubleshooting](references/debugging.md)
oakoss